Fixed a security issue by disallowing binding expressions to include any
properties that are assignable to certain sensitive types (Class,
ClassLoader, ActionBeanContext, ServletRequest, ServletResponse,
HttpSession).